CVE-2026-41254
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
Published Apr 18, 2026 · updated Jun 17, 2026 · littlecms little cms
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Apr 18, 2026 · NIST NVD
Detected
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
Jun 17, 2026 · NIST NVD
Updated
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
Affected
- cpe littlecms/little cmsversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-41254
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-41254
Little CMS (lcms2) through 2.18 has an integer overflow in CubeSize in cmslut.c because the overflow check is performed after the multiplication.
nvd.nist.gov